Zizmor Security Scan #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Zizmor Security Scan | |
| on: | |
| # Weekly scheduled scan (Sundays at 3 AM UTC) | |
| schedule: | |
| - cron: "0 3 * * 0" | |
| # Manual trigger | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| zizmor-scan: | |
| name: Run zizmor Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| persist-credentials: false | |
| - name: Install zizmor | |
| run: | | |
| curl -sSfL https://github.com/woodruffw/zizmor/releases/download/v1.23.1/zizmor-v1.23.1-x86_64-unknown-linux-gnu.tar.gz | tar xz | |
| chmod +x zizmor | |
| sudo mv zizmor /usr/local/bin/ | |
| - name: Run zizmor scan | |
| run: | | |
| zizmor --format sarif .github/workflows/ > zizmor-results.sarif || true | |
| zizmor --format json .github/workflows/ > zizmor-results.json || true | |
| - name: Upload SARIF results | |
| uses: github/codeql-action/upload-sarif@f6091c0113d5d965a3b7e0fbb2a0742e28138f9f # v3.28.13 | |
| with: | |
| sarif_file: zizmor-results.sarif | |
| category: zizmor | |
| - name: Upload JSON results | |
| uses: actions/upload-artifact@4b3b1f5e5a85c5e88a4f5b8c3d8a7f6e5d4c3b2a # v4.3.6 | |
| with: | |
| name: zizmor-results | |
| path: zizmor-results.json | |
| if-no-files-found: ignore | |
| - name: Check for critical findings | |
| run: | | |
| CRITICAL_COUNT=$(jq '[.[] | select(.severity == "critical")] | length' zizmor-results.json 2>/dev/null || echo "0") | |
| HIGH_COUNT=$(jq '[.[] | select(.severity == "high")] | length' zizmor-results.json 2>/dev/null || echo "0") | |
| echo "zizmor findings summary:" | |
| echo " Critical: $CRITICAL_COUNT" | |
| echo " High: $HIGH_COUNT" | |
| if [[ "$CRITICAL_COUNT" -gt 0 ]]; then | |
| echo "::error::zizmor found $CRITICAL_COUNT critical security issues" | |
| exit 1 | |
| fi | |
| if [[ "$HIGH_COUNT" -gt 0 ]]; then | |
| echo "::warning::zizmor found $HIGH_COUNT high severity issues" | |
| fi |